Access Denied for password reset page

Question

I am trying to redirect user to edit profile page after accessing the password reset link, code looks like

function mymodule_reset_menu_alter(&$items) {
  // Drupal's default behavior is to show the user a log-in form before
  // their user profile.  We replace this item to skip the uneccesary step.
  $items['user/reset/%/%/%'] = array(
    'title' => 'Account settings',
    'access callback' => 'simple_pass_reset_pass_reset_access',
    'access arguments' => array(2, 3, 4),
    'page callback' => 'test',
    'page arguments' => array(2, 3, 4),
    'type' => MENU_CALLBACK,
  );

}

function test($uid, $timestamp, $hashed_pass, $option = NULL) {
  global $user;
  // Show the user edit form instead of silly one-time login form.
  $account = user_load($uid);
  $user = $account;
  $token = drupal_random_key();
  $_SESSION['pass_reset_' . $user->uid] = $token;
  drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token)));
 }

while test() is callback for menu 'user/reset/%/%/%'.

The issue is when the user access the link for first time user gets "Access Denied" for second time user successfully redirects to edit profile page with password reset option. I think issue must be in the way the token is generated as it is the only thing which changes, but have no clue on how to fix this.

Answer 1

Drupal has an option to just login using the user reset link. When you add /login after the reset link the user is logged in directly and redirected to their their profile page.

Answer 2

After new information, what I have done:

1. installed simple_pass_reset module and enabled it.
2. putted your code in my custom module.
3. generated reset link for the user, something like this user/reset/1/1421238775/nyUMDVFKAizcXsjVFNsZQcUdh6Y3CG9TdbEzFaZnyJQ/login
4. this link redirected me to user/1/edit?pass-reset-token=Nock8yzQbSa8Sp8EC2JwtjPzDwv3vwPiGAyPyp0l_os

it works because drupal have default behavior when we add /login to reset link, it won't redirect without it

---

After some investigation

it will work like this without /login if:
- disable simple pass reset module
- change code

function adyax_ajax_menu_alter(&$items) {
  // Drupal's default behavior is to show the user a log-in form before
  // their user profile.  We replace this item to skip the uneccesary step.
  $items['user/reset/%/%/%'] = array(
    'title' => 'Account settings',
    'page callback' => 'test',
    'page arguments' => array(2, 3, 4),
    'access callback' => TRUE,
    'type' => MENU_CALLBACK,
  );
}

function test($uid, $timestamp, $hashed_pass, $option = NULL) {
  global $user;
  // Show the user edit form instead of silly one-time login form.
  $account = user_load($uid);
  $user = $account;
  user_login_finalize();
  $token = drupal_random_key();
  $_SESSION['pass_reset_' . $user->uid] = $token;
  drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token)));
}